Translation method in which page-table progression is dynamically determined by guard-bit sequences

ABSTRACT

The method allows for a simple and fast transformation of virtual addresses of a large fine grained and sparsely occupied address space into real addresses. The transformation is effected in several steps, the reference from step to step being controlled by additionally stored information. Due to this information, the so-called guard, one may depart from the conventional rigid step division. It is possible to skip individual steps on account of the guard, resulting in a shortening of the transformation process by skipping or omitting intermediate steps.

This application is a 371 of PCT/EP94/01453 filed May 6, 1994.

The present invention refers to a method for mapping a first bit stringof a first length onto a second bit string of a second length.

Such a method is particularly applicable for transforming the address ofa virtual memory into the address of a real memory in the so-called MMU(Memory Management Unit) of computers with virtual memories.

The virtual to real address transformation is conventionally effected ina multi-step process with the use of so-called page tables. A firsttable is addressed by means of the first bits of a virtual address andthe value stored at this table address is read out. The read out valueis the starting address of a second table that is addressed by the nextgroup of bits of the virtual address. Since the groups each comprise apredetermined fixed number of bits that is constant from group to group,this known process runs off in several steps until it eventually arriveson the data storage page, i.e., the real memory, with the final table.The final table gives the data page (also referred to as a page frame).The remaining bit group (last bits of the virtual address) thenrepresents the address (offset) within the data page. This process istime consuming and involves a large data amount, in particular if oneimagines address spaces of 2⁶⁴ -bytes that are sparsely occupied and/orfine-grained. Further, known methods only allow for rather limitedvariations in the size of data pages, e.g., only data pages of 4 MB and4 KB in size can be realized simultaneously. However, this often isinsufficient since it may be desirable and necessary to be able toprovide a plurality of data pages having different sizes.

Modern operating system designs (Mach and L3, for example), the ideas ofobject orientation with a multitude of small objects, and in particularthe increase in processors with large address spaces (64-bit addresses)point out substantial shortcomings of previously available MMUs. Amongthese shortcomings are the granularity that is too coarse and toouniform for large address spaces, the immense costs for sparselyoccupied address spaces (2⁶⁴ -byte address spaces are always sparselyoccupied) and the insufficient support of hierarchical structures.Address spaces of such size require high-resolution MMUs.High-resolution MMUs must be able to process 64-bit-wide virtualaddresses or even wider addresses (128-bit addresses and even wideraddresses are possible), they should be able to manage page sizesstarting with 8 bytes (8, 16, 32, . . . , 1K, 2K, 4K, . . . ) thatshould be combinable in the address space, and, for any occupancy of theaddress space, high-resolution MMUs should require a maximum of 16 to 32bytes of management information per allocated page (depending on thesize of the virtual and the real address space).

As already stated above, virtual addresses are presently transformed toreal addresses in several steps using a tree of individual page tables(the individual tables). Referring now to FIG. 18, we consider a singletransformation step of a virtual (binary) address v for an action x bymeans of a page table with the address p according to the conventionalmethod. For this purpose, v is split into a higher part u (consisting ofa specific number of higher bits) and a lower part v' (consisting of thelower bits). Using u, an entry of the page table initially addressed byp. This entry includes an access attribute a and a new address p' as thestarting address of the next table or the next page table of the tree.For many computers, actions consist of the read/write or executeoperation and the user/kernel mode of operation. The access attributeswhich permit certain actions (in the extreme case, all actions or none)are constructed correspondingly. The set and semantics of concreteactions access attributes and the method of checking "action againstattribute" is irrelevant from the present viewpoint. The crucial pointis that it is decided only on account of action x and access attribute awhether to allow or to abort the action. If the access attributeprohibits the action (x>a), transformation is aborted and page fault issignaled. If the action is valid (x≦a), x, p' and v' are passed to thenext level transformation as input parameters. It is to be noted that v'is shorter than v by the bit width of u. As soon as the last level isachieved, p' points to the beginning of the data page and v' is theoffset within the page. A two-level transformation produces thesituation illustrated in FIG. 19. If 64 bit virtual addresses are to betransformed in this way an if the minimum page size is to be 16 bytes,this can be achieved, for example, by means of a ten-leveltransformation (4 KB per page table). However, sparsely occupied addressspaces thus require intolerable management costs. 1024 16-byte pages canbe allocated in such a way that 20 KB of management data are necessaryper 16 data bytes, which are 0.08% user data. By using a 60-leveltransformation (8 bytes per page table), management costs decrease tothe minimum, namely 400 bytes, which are however still only 4% userdata. In addition, a 60-level transformation process would be tootime-consuming. If we consider smaller address spaces with 32 bitaddresses, for example, the corresponding values are getting better, butthey are still intolerable. A 14-level transformation (16 bytes per pagetable) would thus produce only 8% user data in the worst case.

In a further known address transformation method (shortly referred to asInverted Page Tables), each table consists of one entry per page frameof the real memory which contains the virtual address of the allocatedpage of the virtual address space. Access is performed with the aid of ahash function. The method is illustrated in FIG. 20. Upon transformingthe virtual address v into the real address r, the lower part w isadopted directly. The higher part u is mapped to a value p by means ofthe hash function, the value p both identifying the presumable pageframe in the real memory and serving for indexing the inverted pagetable. If the corresponding entry contains the correct virtual addressu, it is a hit. Otherwise (not shown in FIG. 20) further page frameshave to be examined by means of rehashing or linking until getting a hitor a page fault. Since, for inverted page tables, management informationdepends only on the size of the real memory (and the page size), but noton the size and number of virtual address spaces, space problems do notoccur. Nevertheless, three disadvantages make the method useless forfine grained huge address spaces:

1. All pages must be of equal size, i.e. they must be of minimum pagesize. A mixture of small pages (16 . . . 256 bytes) and medium pages (2. . . 16 KB) would however be more favourable in almost any case inpractice. Several page sizes could be admitted by using a specific hashfunction and inverted page table for each size.

Without a fixed division of the address space, however, several sizes(in the extreme case all sizes) would have to be tested sequentiallyupon each address transformation as a rule. On account of the tablesize, a parallel implementation seems to be hardly possible.

2. In the case of small pages, large real memories and huge addressspaces, the used hash function must be extremely good to guarantee asufficiently high hit rate. Procedures which change the hash functiondynamically, such as universal hashing, are likely to be necessary.Hardware and software overhead would be immense.

3. Sharing pages or entire address space regions is not possible. Thehierarchical operations (lazy copying, copy on write, mapping, locking)required by modern operating systems are not feasible with acceptableefficiency.

For cost reasons, the page table tree cannot be parsed upon each memoryaccess by a program. This overhead is avoided with the aid of a specificcache for address transformation, a Translation Lookaside Buffer (aso-called TLB--also referred to herein as a mapping unit). Generally,more than 90% of all address transformations are done by TLB hits at nocost. Only in the case of a TLB miss, the page tables are parsed.Conventional TLBs typically hold 32 to 128 entries each of whichdescribing the address transformation of a page. Some of them are fullyassociative, but often they are only 4-way-associative.

Virtually addressed caches are sometimes used instead of or in additionto these TLBs.

It is the object of the present invention to provide a method formapping a first bitstring of a first length onto a second bitstring of asecond length, which, with a reduced number and/or size of page tables,allows to realize an effective and efficient mapping of a firstbitstring onto a second bitstring, in particular in the case of sparselyoccupied huge address spaces (small data pages and/or page frames).

The following is, in particular, a description of the functions of anMMU which allows the realization of huge, sparsely occupied addressspaces (2⁵⁴ bytes or more) of an as fine as possible granularity withacceptable memory and time cost. The advantages of the previouslydescribed tree-like page tables (sharing of subtrees, support ofhierarchical operations) are to be maintained. Granularity should not beuniform, i.e. the page size should potentially vary in the address spacefrom position to position. The pages are always aligned, i.e. v mod2^(i) =0 always holds for the virtual starting address v of a page sizeof 2^(i). A ratio of user data to management information (page tables)of 1:1 is considered to be still acceptable for the extreme case (onlypages of minimum size, which are distributed randomly). The ratio shouldimprove drastically with increasing page size. The time cost ofconventional MMUs is regarded as acceptable.

The object is solved, according to the invention, by means of a methodfor mapping a first bitstring of a first length onto a second bitstringof a second length, wherein

a) a first memory region with a first starting address (p) and a firstlength is preset,

b) it is checked whether the length of said first memory region isshorter than or equal to 2 to the power of the length of the firstbitstring (v) and, if this is the case, the sum of the first startingaddress (p) of the first memory region and of the first bitstring (v)gives the second bitstring (data page reached), and if said check isnegative, the first memory region is used as a first table, and

c) bits (u) are selected from specific locations of the first bitstring(v), the unselected remaining bits forming a residual bitstring (w, v'),

d) the selected bits (u) of the first bit string (v) specify an entry ofthe first table.

e) this entry is read out from the first table,

f) the starting address (p') and the length of a further memory regionand a bit sequence (g) comprising a number of bits are derived from theread-out table entry,

g) a number of bits is selected from the residual bit string (w, v'),the number being equal to the number of bits of the bit sequence (g)derived from the table entry of the first table,

h) it is checked, whether the sequence of the selected bits of theresidual bit string (w, v') is equal to the bit sequence (g) derivedfrom the table entry of the first table,

i) in the case of a negative check, a fault signal is generated whichindicates that the mapping is not defined for the first bit string (v),

k) the bit sequence (g) is extracted from the residual bit string (w,v') if the above check is positive, and

l) the method is repeated from step b) using the non-extracted remainingpart (v') of the residual bit string (w, v') as the first bit string (v)and the starting address (p') and the length of the further memoryregion as the starting address (p) and the length of the first memoryregion.

According to the present method, one starts from a first bit stringrepresenting, for example, a virtual address, and maps (transforms,converts or the like) this first bit string onto a second bit stringparticularly representing the real address. A first memory region with astarting address and a length is specified. If a region with a greaterlength as that of the first memory region cannot be addressed completelyby this first bit string, the second bit string is obtained from the sumof the starting address of the first table and the first bit string,i.e. the sum of the numbers respectively represented by the startingaddress and the first bit string. In this event, the d at a page hasbeen reached.

The normal case will be that in the first transformation step 2exponentiated by the length of the first bit string is larger than thelength of the first memory region. In this case, the first memory regionis a first table used for address transformation, the number of entriesin the table usually being a power of 2. Bits are selected from thefirst bit string at specific locations so that the mapping of theselected bit onto the entries of the first table is unambiguous, i.e.that the number of the selected bits is equal to the logarithm to thebase 2 of the number of table entries. The unselected remaining bits ofthe first bit string form a residual bit string. The selected bits ofthe first bit string specify the entry of the first table that is to beread out. This entry contains information on the starting address andthe length of a further memory region. Furthermore, this entry of thetable also holds a bit sequence with a specific bit length. This bitsequence is a data value later also referred to as the "guard". It isthen checked whether the residual bit string starts with this bitsequence, for example. If this is the case, a fault signal is issuedthat indicates that the mapping is not defined. A positive check,however, will cause the residual bit string to be "shortened", i.e. thehead bits are cut off in this example. Then, the process will startanew, the remaining part of the residual bit string being used as thenew first bit string and the starting address, as well as the length oftheir memory region are taken as the starting address and the length ofthe new first memory region.

According to a variant of the method, the residual bit string ispermutated prior to being checked for containing the guard, whereafterit may possibly be (re-)permutated.

The main idea of the invention is mirrored by the fact that a table isnot only provided with the starting address for the table of the nextlevel or the data page, but also with a value (referred to as guard) inthe form of the bit sequence that indicates how many (and possiblywhich) bits are cut off from the residual bit strings, in order to usethe head bits of the remaining, not cut-off part of the residual bitstrings to address the next memory region (table or data page), thestarting address of which is contained in the read-out entry of theprevious table, and to read out the entry of the table address thusspecified. A fault signal indicating that the transformation is notdefined or not possible is always generated when the bit sequencerepresenting the guard is not contained in the residual bit string ofthe first bit string or in the first bit string itself. The longer theguard, the fewer transformation levels (cycles) are required.

Advantageously, the first bits of the first bit string are used tospecify the address to be read out from the first table out. Preferably,also the guard is compared to the first bits of the remaining residualbit string for identity. Other bits than the first bits may be used inboth cases.

An advantageous embodiment of the invention is mentioned in claim 4. Inthis case, the identical mapping is considered as a special case ofpermutation.

Finally, it would be advantageous to modify the method of the presentinvention such that per transformation step several guards are checkedas to whether their respective bit sequence is contained in therespective residual bit string. This embodiment is mentioned in claim 5.Thus, an increase in transformation speed or a reduction of the memorysize necessary for the tables is achieved. If one were to call thepreviously described inventive method "(simple) guarded page tables",the method of claim 5 would concern "k-associative guarded page tables",k indicating the number of guard bit sequences to be compared pertransformation step.

The features of further advantageous embodiments of the invention arementioned in the other subclaims.

The following is a detailed description of embodiments of the invention,taken in conjunction with the drawings. The figures show:

FIG. 1--an illustration of a transformation step of the present methodaccording to the embodiment as "simple guarded page tables",

FIG. 2--an example of three binary page tables each having two entriesin a 20-bit address transformation with the use of the method of FIG. 1,

FIG. 3--an illustration of a transformation step of the present methodaccording to the embodiment as "k-associative guarded page tables",

FIG. 4--the method of the present invention in its embodiment with"k/j-associative guarded page tables",

FIG. 5--the method of FIG. 4, yet with a stored pointer element,

FIG. 6--a schematic illustration of the implementation of a plurality ofsuccessive TLBs (referred to in the claims as mapping unit) to beexecuted in the "guarded page table" method,

FIG. 7--an implementation for a cache with a TLB₀ function,

FIG. 8--a first alternative of an implementation for the element denotedas TLB₁ in FIG. 6,

FIG. 9--a second alternative of an implementation for the functiondenoted as TLB₁ in FIG. 6,

FIG. 10--an illustration of a transformation step of the present methodaccording to a further embodiment (user level mapping),

FIG. 11--a schematic illustration of a part of the tree structure forexplaining the execution thereof according to the method of FIG. 10,

FIG. 12--an illustration of the conventional "real" aliasing forexplaining the difference between this method and the one of FIGS. 10and 11,

FIG. 13--an illustration of a transformation step according to anotherembodiment of the invention,

FIG. 14--an illustration of the execution of a transformation stepaccording to another embodiment of the invention,

FIG. 15--a first alternative of a hardware implementation of thetranslator of a MMU according to the invention,

FIG. 16--a second alternative of a hardware implementation of thetranslator of a MMU according to the invention,

FIG. 17--a third alternative of a hardware implementation of thetranslator of a MMU according to the invention,

FIG. 18--an illustration of a transformation step of the conventionalpage table method,

FIG. 19--a graphic representation of the conventional page table methodas a two-level method, and

FIG. 20--an illustration of a transformation step of the conventionalmethod with "inverted page tables".

With reference to FIG. 1, the following is an explanation of theexecution of a transformation step according to the method using simpleguarded page tables.

The central idea of guarded page tables is the supplementation of eachpage table entry by a bit sequence g of variable length which isreferred to as guard. First a page table entry of a page table with thestarting address p is selected by the highest part u of the virtualaddress upon each transformation step in the same way as with theconventional method, and the action x is examined against the accessattribute a. However, the selected entry contains not only accessattribute and pointer (starting address) for the next table, but also afurther bit sequence, the so-called guard g. By means of the currentlength of g, the remaining virtual address is split into a higher part w(of equal length as g) and a lower part v'. Then, it is checked whetherg=w holds. In the case of inequality, the transformation is aborted withpage fault, in the case of equality, it is continued with x, p' and v'in the next level or p'+v' is delivered by the next level as a realaddress.

It is to be noted that the length of the guards may differ from entry toentry. Their current length is therefore contained in the page tableentry and is coded as a length field or in another suitable way. Forguards of the length 0 (g=.O slashed.), the method works just as theconventional one. But in all cases where conventional page tables withexactly one occupied entry are required, a guard can be used instead. Aguard can even replace a sequence of such page tables that contain onlyone valid entry, respectively. This saves both memory capacity andtransformation steps, i.e. guards act as a short cut.

As an example, FIG. 2 illustrates the transformation of a 20-bit addresswhich uses three binary page tables (2 entries per table). Further, eachpage table entry contains not only the pointer to the next level pagetable or data page (in the part denoted by p), but in addition a sizespecification s for this object. In the case of page tables, s refers tothe number of entries; all powers of 2, i.e. 1, 2, 4, 8 . . . , areadmissible. The length of u is obtained from the current page tablesize. One can show that on account of the above flexible tree structure,page table trees can be constructed by means of guards in such a waythat a maximum of two page table entries is required per data page,independently of address space size and page size.

Together with the data pages varying in size, more than 50% user dateshould be thus attainable in almost all cases. With 8 bytes per pagetable entry, guards of a maximum length of 30 bits can be used. Amaximum of 16 bytes of management information per page are thusnecessary for 32-bit addresses. 64-bit addresses might need longerguards in some cases, then they are realized by an additional entry of 8bytes. In the worst case (never more than one page per 2³¹ bytes andonly 16-byte pages), 40% of the data will be user data.

As also shown, address transformation trees can be constructed such thata maximum of n/2 levels is necessary for an n-bit address transformationwithout exceeding the above storage requirements. Consequently, amaximum of 30 levels is necessary for 64-bit addresses, for 32-bitaddresses a maximum of 14 levels, to obtain 16-byte pages.

FIG. 3 illustrates a transformation step of the method usingk-associative guarded page tables. In the case of k-associative guardedpage tables, not one page table entry is selected in each step, but kentries. For the highest possible speed, k parallel units and paralleldata paths for k page table entries are needed. The page table does notconsist anymore of s simple entries, but of s/k clusters which consistof k simple entries each. u is correspondingly shorter and selects acluster. If k>s holds for a page table, k is reduced for thistransformation step, i.e. one works only in an s-associative way. Withk=4, the situation illustrated in FIG. 3 is obtained. Here, the fourselected entries are read in parallel and analyzed (in parallel). It isto be noted that the guards g_(i) usually differ with regard to theirlengths, i.e. for the various comparisons, the bit string reduced by uis divided into different pairs w_(i), v'_(i). If no hit occurs (allg=w), transformation is aborted with page fault. In the case of exactlyone hit g_(i) =w_(i), the access attribute a is checked against theaction x, and, if it is true, x, p_(i) and v'_(i) are passed to the nextlevel and/or returned as a real address. In the case of several hits,the result is not defined. As can be shown, 8-associative guarded pagetables enable an n-bit address transformation within a maximum of n/4steps within a maximum of 2 (simple) entries per data page.Consequently, for 64-bit addresses, a maximum of 15 levels is required,for 32-bit addresses 7 levels, to obtain 16 byte pages.

FIG. 4 illustrates an example for a transformation step of the methodusing k/j-associative guarded page tables. k/j-associative guarded pagetables show the same semantics as k-associative ones. However, theyrequire only k/j-fold parallelism for realization. For highest possiblespeed, we therefore only need k/j parallel units and parallel data pathsfor k/j entries. (In this case, k should be evenly divisible by j. Inaddition, these two should be powers of 2.) The clusters comprising kentries are divided into j subclusters (sub-regions) (which arecontiguous and of equal size). If k>s holds for a page table, k isreduced to s for this transformation step. If s≦k/j, work iss-associative, otherwise it is s/j'-associative, j' being selected suchthat the length of the subclusters remains unchanged, i.e. k/j=s/j'.This will make no problems if s, k and i are powers of 2. To maintainthe semantics of k-associativity, the transformation operation isperformed sequentially (k/j-parallel) on different subclusters until ahit occurs or until all j subclusters are processed. If no hit is found,address transformation is aborted with page fault, in the case of a hit,the procedure is continued as described in connection with FIG. 3.Obviously, this method is only efficient if possible hits are oftenfound at the very first attempt. To obtain a hint, after removing u, thehighest log₂ (k) bits of the remaining virtual address are taken as ahint (however, the hint bits are also used further for building w_(i).)In the case of simple k/j-associative guarded page tables, one beginswith the subcluster addressed by h/j. The further sequence can bedetermined by incrementing h/j modulo. Other sequences are equallypossible, e.g. from 0 to j-1 with omission of h/j. They have nearly noinfluence on efficiency.

In the case of k/j-associative guarded page tables with hint, each p (inpage table entries, in the root and in the TLBs) is expanded by a fieldH with k hint elements (this is relatively small with k log₂ (j) bits.)One begins with the subcluster addressed by p.H h!=h' in each step. If ahit is not achieved in the subcluster addressed by h', but in anothersubcluster of number h", the hint element is reloaded: p.H h!:=h".Consequently, hints adjust automatically.

As is shown, 8/2-associative guarded page tables with hints allowaddress transformation within a maximum of n/4 steps for a maximum of 22/7 entries per data page. In general, they need the same time for thisas 8-associative guarded page tables do, but they require only 4parallel units instead of 8 and correspondingly narrower data paths.

To achieve a sufficiently fast address transformation, guarded pagetable translators have also to be supported by TLBs. The specificproblems are as follows: different page sizes, larger working sets (morepages because of smaller granularity); deeper trees with huge addressspaces (depth 15 for 60 bit address transformation), i.e. higher costfor TLB miss.

A multilevel TLB as illustrated in FIG. 6 is used for solution.

TLB₀ is a more or less conventional TLB on page basis or a virtualaddressable cache; a hit delivers the corresponding real addressdirectly. TLB₁ operates on larger regions (e.g. 16 MB) so that enteringinto the page table tree transversally is possible upon a near miss(TLB₀ miss and TLB₁ hit), and only a small part of the tree has to beparsed. If required, this method can be extended in a natural way byfurther TLB₁ levels.

The pages varying in size are an essential problem of the TLB₀illustrated in FIG. 6. Wellknown solutions are a full- associative TLB(such as for MIPS R4000), which results in high circuit cost, or avirtual-addressed cache, which is faster than a real- addressed cache,yet has difficulties with synonyms and consistency problems withmultiprocessors.

Another solution is a virtual- and real-addressable cache, whichcombines the advantages of a virtual-addressed cache (TLB for smallpages, for many pages of varying size) with those of a real-addressedcache (synonyms are possible, suitable for multiprocessor systems). Thisis illustrated in FIG. 7. Here, field a contains the resulting accessattribute which is obtained from the combination of the accessattributes of the individual levels during address transformation.

Just as for TLB₀, several solutions are possible for TLB_(i) (and forhigher levels). A specific cache (direct mapped or n-fold associative)can be used for the individual regions. It is addressed with the region(e.g. v÷2²⁴) and delivers the next possible entrance to the page tabletree in the case of a hit. This is the address of the corresponding pagetable entry and its depth, i.e. the number of leading bits of thevirtual address which have already been decoded up to this entry (it isto be noted that the entry has not necessarily to be located on the"region depth", but it can also be positioned on a higher level due tothe guards) and which therefore have to be removed from the virtualaddress v upon entering into the address transformation treetransversally. a contains the access attributes obtained by combiningthe page table access attributes during the address transformation up tothe region. In the case of TLB_(i) hit and admissible action (x≦a) theaddress transformation is performed step by step according to the methodof the present invention. One begins with v' as a virtual address and p'as an address of a page table with only one entry (since TLB_(i) doesnot deliver the page table, but supplies the corresponding page tableentry). In the case of TLB_(i) miss, a complete address transformationaccording to the present method is performed. The best possible entranceto the region found in this way is then included in the TLB_(i) cache.

A further alternative to the TLB_(i) of FIG. 6 is shown in the upperpart of FIG. 9. When using a sufficiently large TLB₀ respectively avirtual-addressable data cache, one can do without a specific cache forTLB_(i). One can use instead a two- (or more) level hierarchy of addresstransformation trees. If linearized, the address space is as shown inthe lower part of FIG. 9.

A specific tree is used for each region. The roots of these trees areaccessible via a specific area in the virtual address space (`regionroots`). In the case of a TLB₀ miss, it is now attempted to address thecorresponding regional tree via its virtual address in the area `regionroots`. If one succeeds by means of TLB₀ hit for the correspondingvirtual region root address, one gets a TLB_(i) hit. Subsequently, oneneeds only parse the (not very deep) regional tree. Otherwise, acomplete address transformation of the virtual region root address isexecuted beginning with `root`, and the regional tree is parsedsubsequently. This method requires less hardware, but, in the extremecase (only one page per region), it may require one additional pagetable entry per accessible page. If the smallest page is larger than apage table entry, the additional storage requirements may increasebecause of the fragmentation of the `region root` area.

The following is to address a further feature which is particularlyuseful with fine grained mapping in huge address spaces that aresparsely occupied.

Fine grained mapping enables an access control on the level of logicalstorage objects, e.g. program variables. In this way, it can be usedreasonably both in the area of classical imperative programminglanguages and in object oriented and declarative languages, inparticular for distributed or massively parallel systems. Typicalapplications are as follows:

1. Aliasing

Mapping a virtual storage object onto another virtual storage object.This is used, for example, for object synthesis, but also forconstructing alternative views or simply for parameter passing.

2. Call On Reference

Calling a user-defined procedure upon access. This is to associatespecific access semantics to address space regions, for example, `delayupon read access` (variable value has not yet been computed), `signalupon write access`, `remote object invocation`, `access by proxies` orsimply `access protocol`.

Combining the two methods allows an efficient realization of distributedmemories since access to potentially remote objects is feasible by meansof local object invocation. Memory accesses are performed directly inthe local case and algorithmically in the remote case.

Distinction is by hardware. On the functional level, the operatingsystem (μ-Kernel) can realize all this by means of software. Since,however, mapping is likely to be modified very frequently with thementioned methods, it is desirable to have a facility for modifyingmapping directly within the user level program without using theoperating system. This option should not affect the security paradigm ofthe operating system.

As already mentioned above, user level mapping is of special interest toan MMU admitting fine grained address spaces like presented inchapter 1. The method presented here can also be integrated into otherMMUs showing fine or coarse grained mapping if they are based on thetransformation of a virtual address into a real address by means of apage table tree. However, this is not imperative. Page Table entriesconsist conventionally of an access attribute a which defines theapplicable actions on the address space region and a pointer π which isthe real address p of the next page table level or the data page in thecase of normal address transformation. In addition, each page tableentry has a type τ which determines a.o. the interpretation of thepointer π. The conventional entries are of type τ=translate. For userlevel mapping, new types and special instructions are introduced forproviding a secure modification of mapping. In the alias type, thepointer π is interpreted as a virtual alias address v. If addresstransformation meets an alias entry 2, whose access attribute a allowsthe access action x, on any level, v is added to the remaining addressv' not decoded so far, or the new address is formed from v and v' inanother way. This situation is shown in FIG. 10 for one transformationstep.

Address transformation is restarted with the resulting (v+v', e.g.)which is a virtual address of full length. Consequently, the entirevirtual region covered by the alias entry is mapped virtually to anothervirtual region (see the schematic tree structure in FIG. 11). This is tobe distinguished from conventional real aliasing where several realpointers meet on a page table or data page. Conventional real aliasingis illustrated schematically in FIG. 12. Unlike real aliasing, virtualaliasing is independent of real memory mapping. In this way, it enablesmodifications of mapping by means of user level software independentlyof current real memory allocation and paging without being able toviolate the protection boundaries of the own or foreign address spacesand without being able to weaken the access attributes preset by theoperating system on pages or larger address space regions.

For the type τ=call on reference, the pointer π is interpreted as avirtual address v of a procedure. If address transformation encounters acall on reference entry, whose access attribute a allows the accessaction x, the accessing operation is aborted and the specified procedureis called instead. It gets the current instruction counter (ic) and theinitiating virtual address v_(orig) as input parameters. Just as with apage fault, the initiating instruction can be restarted. FIG. 13 shows atransformation step with the type τ=call on reference.

Call on reference mapping assigns algorithms to address space regions.These can skip the initiating instruction, they can emulate or handle itin a similar way as with page fault, i.e. to remap the address spaceregion in question by alias and to restart the instruction. Sometimes,skipping and emulation of individual instructions can be accelerated byspecial processor instructions (see below under the additionalinstructions "getmap", "getlength" and "execute").

Processors with strict load/store architecture allow to improveemulation by additional parameters besides ic and V_(orig) passed to theassociated procedure--upon write access--the `write access` code, theoperand size (byte, word, . . . ), and the operand value,--upon readaccess--the `read access` code, the operand size (byte, word, . . . ),and the number (address) of the destination register. With processorswith more complex instructions, the following additional parameters maybe passed instead: operation (mov, add, inc, . . . ), operand size(byte, word, . . . ), source register/memory address, destinationregister/memory address.

The instruction set of the processor is extended by the non-privilegedinstruction map. This enables user level software to modify alias andcall on reference entries directly. A page table entry is denotedunambiguously by the virtual address region it covers precisely in theprimary address transformation (the reverse does not hold since an entrycan be responsible for several virtual address space regions on accountof real sharing). By primary address transformation, we here understandthe translation process which transforms the original virtual addressuntil a page fault is diagnosed, until an alias entry, a call onreference entry or an entry referring to a data page is found. Theaddressed entry is specified accordingly by the virtual base address band size s of the corresponding address space region. The instruction

    map ((b, s), (τ, π))

loads the addressed page table entry with τ and π, provided that τ isalias or call on reference (consequently, virtual-real mappings cannotbe defined or modified) and the target entry exists (consequently,entries cannot be created secretly) and is accessible from the currentmode (user/kernel) (consequently, the operating system can protectitself) and it is already of the alias or call on reference type.Overlaying a translate entry in the user part of the address space byalias or call on reference is not security-relevant, but it would leadto dead subtrees without the operating system noticing it. Otherwise,map will lead to page fault. By this, user level software can modifycorresponding entries, i.e. switch between alias and call on referenceand/or change the alias or the associated procedure address. However,this instruction cannot be used either for creating new entries or formodifying available virtual-real mappings or for weakening accessattributes.

Creating and deleting corresponding entries together with the necessarymodification of the page table tree should be realized by system callsin the operating system kernel. Alias and call on reference entries canbe realized by the operating system as long-living objects, sinceswapped-out entries lead to page fault both upon normal access to theaddress space region and upon map access to the entry. Further processorinstructions are not necessary, but they might be of interest forspecific processors and applications:

    getmap ((b, s), (τ, a, π))

reads a page table entry, provided that it exists, is accessible fromthe current mode and is of the alias or call of reference type. Skippingand emulation by means of a procedure associated with the address spaceregion might get more efficient by using instructions which return thelength of another instruction or which can execute it with a modifiedmemory address:

    getlength (dest, ptr)

returns the length of the instruction which is located at the virtualaddress `ptr` in `dest`.

    execute (ptr, v)

executes the instruction located at the virtual address `ptr` usinghowever the virtual address v instead of the memory address actuallyused in the instruction. For multi-address machines, more complex formsof the instruction might be necessary. Both instructions are not usefulfor processor architectures showing only a few and simple instructionformats and addressing modes. In principle, the entry types alias andcall on reference are sufficient (in addition to translate).Combinations might also be of interest:

    τ=call on write/alias on read

    τ=call on read/alias on write

However, the page table entries must be enlarged in this case to includev and v together, or v has to be the same for all these entries. Thenthe map instruction of course works on these two types, too.

For associating specific hardware actions with address space regions,e.g. activating complex bus protocols for access to a remote memory,further (special) types can be used for τ.

For multiprocessor machines with shared memory, an address space regionshould sometimes be locked so that accesses to it by other processorsare delayed automatically until release. Of course, at least oneprocessor should be able to access. This is done by virtual or realaliasing. Locking can be done by associating an empty routine to theaddress space region, i.e. by using a call on reference page table entrypointing directly to a ret instruction. Unlocking is done by modifyingthe mapping to alias. For some architectures, a specific new typeτ=locked may be useful, since, in some cases, it can be implementedsomewhat more efficiently since it allows lock/unlock withoutreinterpretations in cache and TLB. This situation is represented inFIG. 14. If address transformation encounters such an entry, it isrestarted completely. Only if another processor sets the entry totranslate again or modifies the page table tree in such a way that theentry is no longer involved, the delay is terminated. Locked entriesdiffer only in the type from translate entries. Changes between the twotherefore only require a consistent modification of the types of thecorresponding cache and the TLB entries (for larger objects, a TLB flushis probably more efficient), but no modification of the virtual→realmapping. Two further instructions are used for changing between lockedand translate:

    lock (b, s) unlock (b,s)

lock sets the addressed page table entry to locked and unlock sets itagain to translate, provided that the target entry exists and isaccessible from the current mode (user/kernel) and is already of thetype translate or locked. In all other cases, page fault will betriggered.

Encoding the above instructions and/or bit strings or sequences offlexible length (including guards), the following possibilities areavailable, for example.

Pairs (b, s) of n-bit-wide base address b and size s=2^(i) can be codedas n-bit-value ##EQU1## for s≧2 if the base address is always s-aligned,i.e. b mod s=0. Then the bit representation looks as follows: ##STR1##

The method can be used for coding bit strings of variable length up tomaximum n-1 as well, e.g., guards of Guarded Page Tables can be coded bythis. A bit string b of length ∥b∥ is represented by the n-bit-number

    2.sup.n-∥b∥ b+2.sup.n-∥b∥-1

In both cases, the decoding hardware takes the lowest 1-bit as delimiterto the bit string (or the base address) b. Of course, the roles of 1-bitand 0-bits can be exchanged or the higher bits can be used for thelength coding. ##STR2##

With reference to FIGS. 15 to 17, the following is a short descriptionof possible hardware realizations of a translator of a MMU operatingaccording to the present invention.

According to FIG. 15, the TLB₀ and the TLB are provided as independenthardware. Instead of the cache (see right hand part of FIG. 15), onecould of course directly connect a conventional memory. If a virtualaddressable cache is used, this may take the functions of the TLB₀, asillustrated in FIG. 16. The block diagram is still simpler, if the TLBis realised by the translator by means of the Cache+TLB₀, as describedbefore in connection with FIG. 9. This will result in the block diagramof FIG. 19.

I claim:
 1. A method for mapping a first bitstring of a first lengthonto a second bitstring of a second length, in particular fortransforming a virtual memory address of a virtual memory into a realaddress of a real memory, whereina) a first memory region with a firststarting address (p) and a first length is preset, b) it is checkedwhether the length of said first memory region is shorter than or equalto 2 to the power of the length of the first bitstring (v) and, if thisis the case, the sum of the first starting address (p) of the firstmemory region and of the first bitstring (v) gives the second bitstring(data page reached), and if said check is negative, the first memoryregion is used as a first table, and c) bits (u) are selected fromspecific locations of the first bitstring (v), the unselected remainingbits forming a residual bitstring (w, v'), d) the selected bits (u) ofthe first bitstring (v) specify an entry of the first table, e) thisentry is read out from the first table, f) the starting address (p') andthe length of a further memory region and a guard bit sequence (g)comprising a number of bits are derived from the read-out table entry,g) a number of bits is selected from the residual bitstring (w, v'), thenumber being equal to the number of bits of the bit sequence (g) derivedfrom the table entry of the first table, h) it is checked, whether thesequence of the selected bits of the residual bitstring (w, v') is equalto the bit sequence (g) derived from the table entry of the first table,i) in the case of the check results being negative, a fault signal isgenerated which indicates that the mapping is not defined for the firstbitstring (v), k) the bitstring (g) is removed from the residualbitstring (w, v') if the above check is positive, and l) the method isrepeated from step b) using the non-removed remaining part (v') of theresidual bitstring (w, v') as the first bitstring (v) and the startingaddress (p') and the length of the further memory region as the startingaddress (p) and the length of the first memory region.
 2. The method ofclaim 1, characterised in that the bits selected in step c) are theleading bits (u) of the first bitstring (v).
 3. The method of claim 1,characterised in that it is checked in step f) whether the residualbitstring (w, v') of the non-selected bits of the first bitstring (v)has as its head (w) the bit sequence (g) derived from the table entry ofthe first table, and that in step k) the head (w) identical with saidbit sequence is removed from the residual bitstring (w, v'), if theresult of the check in step h) is positive.
 4. The method of claim 1,characterised in that prior to step g), the residual bitstring (w, v')is permutated according to a first permutation rule, and that after stepk) and prior to step l), the remaining part of the permutated residualbitstring (w, v') is permutated according to a second permutation rulebefore the process is carried on with step b).
 5. The method of claim 1,characterised in thatin step d), the selected bits of the firstbitstring specify a table region (cluster) of a first table, in step e),the entries of the region of the first table thus addressed are readout, in step f), the starting addresses (p_(i) ') and lengths of aplurality of possibly different further memory regions and a pluralityof bit sequences (g_(i)) with possibly different bit lenghts are derivedfrom the read-out entries of the initially addressed region of the firsttable, a starting address (p_(i) ') and a length of a further memoryregion being attributed to each bit sequence (g_(i)), the steps g) andh) are carried out in particular in parallel or sequentially for allread-out bit sequences (g_(i)), if all checks in step h) are negative, afault signal is generated, indicating that the mapping for the firstbitstring (v) is not defined, and otherwise, the bit sequence (g_(i)) orone of the bit sequences (g_(i)) for which the check in step h) ispositive is removed from the residual bitstring (w, v') and theassociated starting address and length are taken as the starting address(p_(i)) and length of the further memory region.
 6. The method of claim5, characterised in thatthe region (cluster) of the first table issubdivided into a plurality of subregions (subclusters), each of whichcontains at least one entry consisting of a starting address, a lengthand a further bit sequence, a hint address (h) is set, and the entriesof the subregion initially addressed by the hint address (h) are readout first from the region of the first table initially addressed by theselected bits of the first bitstring.
 7. The method of claim 1,characterised in thatthe first bitstring (v) is successively supplied toat least one mapping means (TLB₁) in which mappings of the firstbitstring (v) to starting addresses (p), as well as lengths of memoryregions and shortening values are stored, and in the case of a mappingof the first bitstring (v) not being stored in the at least one mappingmeans (TLB_(i)), the procedure is started with step a) applied to thefirst bitstring (v) to be mapped, while otherwise the procedure startswith step b) using as the first table the memory region that isspecified by the starting address and length obtained from the at lestone mapping means (TLB₁), and using as the new first bitstring the firstbitstring shortened by the shortening value, the shortening being aseparation of the leading bits, in particular.
 8. The method accordingto claim 1, whereinthe first bitstring is transformed into the secondbitstring in accordance with a transformation method comprising thefollowing steps:defining a table with at least one table entry,selecting bits from specified locations on an input bitstring, theunselected remaining bits forming a residual bitstring, specifying atable entry by the selected bits of the input bitstring, reading outthis entry of the first table, carrying out the following partial steps,if the read-out table entry is of the ALIAS type:removing an aliasbitstring from the table entry. combining the alias bitstring and theresidual bitstring into an output bit string, restarting the entiretransformation procedure from the beginning, using the output bitstringas the new first bitstring.
 9. The method according to claim 1,whereinthe first bitstring is transformed into the second bitstring inaccordance with a transformation method comprising the followingsteps:defining a table with at least one table entry, selecting bitsfrom specified locations on an input bitstring, the unselected remainingbits forming a residual bitstring, specifying a table entry by theselected bits of the input bitstring, reading out this entry of thefirst table, carrying out the following partial steps, if the read-outtable entry is of the SIGNAL type:removing an auxiliary bitstring fromthe table entry, cancelling the entire transformation procedure, andgenerating a signal containing at least the auxiliary bitstring.
 10. Themethod of claim 9, characterised in that on account of the signal, aprocedure is called at the address specified by the auxiliary bitstring.11. The method according to claim 1, whereinthe first bitstring istransformed into the second bitstring in accordance with atransformation method comprising the following steps:defining a tablewith at least one table entry, selecting bits from specified locationson an input bitstring, the unselected remaining bits forming a residualbitstring, specifying a table entry by the selected bits of the inputbitstring, reading out this entry of the first table, restarting theentire transformation method from the beginning, if the read-out tableentry is of the LOCKED type.